Approaches for analyzing entity relationships

ABSTRACT

Systems and methods are provided for obtaining information from at least one computing system, the information including a set of records that respectively identify at least a network-based address of a computing device that accessed the computing system and an account hosted by the computing system that was accessed using the computing device; determining at least a first account and a second account were accessed from one or more computing devices that share a given network-based address based at least in part on the obtained information; and associating the first account and the second account with the network-based address.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.15/703,895, filed Sep. 13, 2017, the content of which is incorporated byreference in its entirety into the present disclosure.

FIELD OF THE INVENTION

This disclosure relates to approaches for analyzing entityrelationships.

BACKGROUND

Under conventional approaches, various types of data can be stored andrepresented using an object model. An object graph created based on theobject model may be made up of a number of objects that serve ascontainers for data. Each object can include a number of objectcomponents.

SUMMARY

Various embodiments of the present disclosure can include systems,methods, and non-transitory computer readable media configured to obtaininformation from at least one computing system, the informationincluding a set of records that respectively identify at least anetwork-based address of a computing device that accessed the computingsystem and an account hosted by the computing system that was accessedusing the computing device; determine at least a first account and asecond account were accessed from one or more computing devices thatshare a given network-based address based at least in part on theobtained information; and associate the first account and the secondaccount with the network-based address.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to determine that the first account andthe second account were accessed within a specified timeframe.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to determine at least one record thatcorresponds to a blacklisted network-based address; and give the user anoption to remove the at least one record and network-based address fromthe information.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to export data corresponding to thenetwork-based address to a data analysis tool for further evaluation.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to determine at least one object in anobject graph that corresponds to the network-based address, the objectgraph being managed by the data analysis tool; and merge at least someof the data corresponding to the network-based address with the objectcorresponding to the network-based address.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to provide an interface through which theassociation between the first account and the second account ispresented.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to enrich at least one record in theinformation to include additional information.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to identify a first record in theinformation; determine that a network-based address included in thefirst record is blacklisted; and associate the first record withinformation that indicates the network-based address is blacklisted.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to identify a first record in theinformation; determine geolocation information associated with anetwork-based address included in the first record; and associate thegeolocation information with the first record.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to obtain a set of financial reports fromat least one computing system, each financial report specifying one ormore network-based addresses used to access one or more financialaccounts; and determine at least a pair of financial accounts that wereaccessed by one or more computing devices that share a givennetwork-based address.

These and other features of the systems, methods, and non-transitorycomputer readable media disclosed herein, as well as the methods ofoperation and functions of the related elements of structure and thecombination of parts and economies of manufacture, will become moreapparent upon consideration of the following description and theappended claims with reference to the accompanying drawings, all ofwhich form a part of this specification, wherein like reference numeralsdesignate corresponding parts in the various figures. It is to beexpressly understood, however, that the drawings are for purposes ofillustration and description only and are not intended as a definitionof the limits of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Certain features of various embodiments of the present technology areset forth with particularity in the appended claims. A betterunderstanding of the features and advantages of the technology will beobtained by reference to the following detailed description that setsforth illustrative embodiments, in which the principles of the inventionare utilized, and the accompanying drawings of which:

FIG. 1 illustrates an example computing environment, in accordance withvarious embodiments.

FIG. 2 illustrates an example analytics engine, in accordance withvarious embodiments.

FIG. 3 illustrates an example diagram, in accordance with variousembodiments.

FIG. 4 illustrates a flowchart of an example method, in accordance withvarious embodiments.

FIG. 5 illustrates a block diagram of an example computer system inwhich any of the embodiments described herein may be implemented.

DETAILED DESCRIPTION

Vast amounts of data may need to be evaluated when identifyingrelationships between entities. Under conventional approaches, ananalyst tasked with identifying relationships between entities canutilize spreadsheet software to import data to be evaluated. Theimported data may be obtained from various different sources. To ensureaccurate review, the analyst may need to manually organize the importeddata into a standardized format. The analyst can then look for patternsor relationships within the imported data. Such conventional approaches,however, are prone to error and thus may not be sufficient to fullydetermine relationships between entities.

A claimed solution rooted in computer technology overcomes problemsspecifically arising in the realm of computer technology. In variousembodiments, a system can be configured to process and analyze data forpurposes of identifying relationships between login-based accounts(e.g., user accounts such as email accounts, social networking accounts,bank accounts, etc.). In some embodiments, the system can ingest accountaccess information (e.g., log data) obtained from various computingsystems (e.g., online service providers). For example, log data obtainedfrom a computing system may include a number of log lines that eachidentify a network-based address (e.g., Internet Protocol address) ofsome computing device that accessed the computing system, what wasaccessed (e.g., an email account), and when the access occurred. Onceingested, the system can standardize the log data so that it can becompared with log data obtained from other computing systems.

In some embodiments, the system can enrich log data using extrinsicinformation. For example, the log data may be enriched to includerespective geolocation information for network-based addresses includedin the log data. In another example, the log data may be enriched toindicate whether respective network-based addresses included in the logdata have been whitelisted for processing. Based on this information,the system can identify any network-based addresses that were used toaccess multiple accounts through any of the computing systems (e.g.,online service providers). In some embodiments, accounts accessed fromcomputing devices that were assigned the same network-based address canbe identified as being related and, optionally, may be flagged forfurther review. For example, the system can determine that one or morecomputing devices assigned the IP address 192.168.1.1 accessed both anemail account accessible through a first online service provider and abank account accessible through a second online service provider. Inthis example, the email account and the bank account may be associated(or linked) since the same IP address was used to access both accounts.

In some embodiments, the system can be configured to ingest other typesof information in which network-based access information is provided.For example, the system can ingest financial reports that specifyrelevant IP addresses as header data. In some embodiments, such ingesteddata can be exported to an external data analysis tool for furtherprocessing. For example, the data analysis tool can be configured tosupplement the ingested information with data uncovered from separateinvestigations. In some embodiments, the data analysis tool cansupplement the ingested information using an object model. For example,the data analysis tool can identify an object associated with somenetwork-based address that is of interest. In this example, the dataanalysis tool can merge (or incorporate) the network-based addressincluding some, or all, log data associated with the network-basedaddress with the identified object.

FIG. 1 illustrates an example environment 100, in accordance withvarious embodiments. The example environment 100 can include at leastone computing system 102 that includes one or more processors andmemory. The processors can be configured to perform various operationsby interpreting machine-readable instructions. In some embodiments, theexample environment 100 may be implemented as an enterprise dataplatform. In some embodiments, the example environment 100 may beconfigured to interact with computing systems of an enterprise dataplatform. In various embodiments, computing systems of the enterprisedata platform may store and manage various data as objects in one ormore object graphs. In some embodiments, an object graph may be made upof a number of objects that serve as containers for data. The objectgraph can also identify various relationships between objects, forexample, using edges (or links) that connect objects. Each object caninclude a number of object components including, for example, aproperties component that includes structured pieces of information, amedia component that includes binary attachments of data (e.g., textdocuments, images, videos, etc.), a notes component (e.g., a free textcontainer), and one or more respective links (or edges) that associatethe object with other objects in the object graph. In some instances,the object graph can include different types of objects. For example, anobject may represent an entity (e.g., person(s), place(s), thing(s),etc.), an activity (e.g., event, incident, etc.), a document, ormultimedia, to name some examples. In some embodiments, datacorresponding to populated object graphs is stored and accessiblethrough one or more data stores 130.

In some embodiments, the computing system 102 can include a data engine104. The data engine 104 can include an analytics engine 106 and aninterface engine 108. The data engine 104 can be executed by theprocessor(s) of the computing system 102 to perform various operationsincluding those operations described in reference to the analyticsengine 106 and the interface engine 108. In general, the data engine 104can be implemented, in whole or in part, as software that is capable ofrunning on one or more computing devices or systems. In one example, thedata engine 104 may be implemented as or within a software applicationrunning on one or more computing devices (e.g., user or client devices)and/or one or more servers (e.g., network servers or cloud servers). Insome instances, various aspects of the data engine 104, the analyticsengine 106, and the interface engine 108 may be implemented in one ormore computing systems and/or devices. The environment 100 may alsoinclude one or more data stores 130 accessible to the computing system102. In general, a data store may be any device in which data can bestored and from which data can be retrieved. The data stores 130 may beaccessible to the computing system 102 either directly or over a network150. In some embodiments, the data stores 130 can store data that can beaccessed by the data engine 104 to provide the various featuresdescribed herein. For example, as mentioned, the data stores 130 canstore object graph data in which information describing objects isstored and accessible. Further, the environment 100 may include one ormore data sources 132 accessible to the computing system 102. Ingeneral, a data source may be any device in which data can be stored andfrom which data can be retrieved. In some embodiments, these datasources 132 can store account access information for various computingsystems (e.g., online service providers, account providers, etc.). Forexample, the data sources 132 may store access logs for a computingsystem. An access log of a computing system may include a number of loglines (or records) that each identify a network-based address (e.g.,Internet Protocol address) of some computing device that accessed thecomputing system, what was accessed (e.g., an email account, a socialnetworking account, etc.), and when the access occurred (e.g., atimestamp), for example. Similarly, the data sources 132 may beaccessible to the computing system 102 either directly or over thenetwork 150. The network 150 may be any wired or wireless networkthrough which data can be sent and received (e.g., the Internet, localarea network, etc.).

The analytics engine 106 can be configured to process and analyze datafor purposes of identifying relationships between various entities. Insome embodiments, these entities correspond to login-based user accounts(e.g., email accounts, bank accounts, etc.). In various embodiments, theanalytics engine 106 can ingest (or import) account access information(e.g., access logs) from various computing systems (e.g., online serviceproviders). The analytics engine 106 can process the account accessinformation to identify any network-based addresses that were used toaccess accounts through any of the computing systems. In someembodiments, user accounts accessed from a computing device that wasassigned the same network-based address can be identified as beingrelated and, optionally, may be flagged for further review. For example,the system can determine that a computing device assigned the IP address192.168.1.1 accessed both an email account accessible through a firstonline service provider and a bank account accessible through a secondonline service provider. In this example, the email account and the bankaccount may be associated (or linked) with the IP address. More detailsdescribing the analytics engine 106 will be provided below in referenceto FIG. 2 .

The interface engine 108 can be configured to generate and provide aninterface (e.g., graphical user interface) through which variousinformation can be accessed and visualized. For example, the interfacecan be provided by a software application (e.g., data analyticsapplication, web browser, etc.) running on a computing device 120 andthrough a display screen of the computing device 120. The interface canprovide users with the ability to access information describing entityrelationships as determined by the analytics engine 106. For example, auser operating the computing device 120 can interact with the interfaceto access reports generated by the analytics engine 106 as illustratedin the example of FIG. 3 .

FIG. 2 illustrates an example analytics engine 202, in accordance withvarious embodiments. The analytics engine 202 may be implemented as theanalytics engine 106 of FIG. 1 . In some embodiments, the analyticsengine 202 includes a data access engine 204, an enrichment engine 206,a correlation engine 208, and an export engine 210.

The data access engine 204 can be configured to obtain account accessinformation corresponding to various computing systems (e.g., onlineservice providers). Such account access information may be provided inthe form of access logs, spreadsheets, and/or comma separated values(CSV) files, to name some examples. In general, account accessinformation corresponding to a given computing system can identify anddescribe incoming network-based connections to the computing system byvarious computing devices (e.g., computers, laptops, smartphones,tablets, etc.). In some embodiments, the account access informationincludes a number of records (or log lines) that each provideinformation about a network-based connection that originated from acomputing device and was used to access the computing system. Suchinformation can include, for example, a network-based address (e.g.,Internet Protocol address) assigned to the computing device, what thecomputing device accessed (e.g., an account username or identifier), andwhen the access occurred (e.g., a timestamp).

In some embodiments, the data access engine 204 can format (or organize)the account access information obtained from the various computingsystems. For example, the data access engine 204 can standardize all ofthe account access information so that account access informationobtained from one computing system can be compared and evaluated againstaccount access information obtained from a different computing system.In one example, the data access engine 204 can format the account accessinformation so that values (e.g., network-based address, name oridentifier of an account that was accessed, timestamp, etc.) associatedwith each record (or log line) correspond to a pre-determined order. Forexample, the account access information can be formatted so that eachrecord (or log line) identifies a corresponding network-based address,followed by a name or identifier of an account that was accessed by acomputing device assigned the network-based address, followed by atimestamp of when the access occurred. Many variations are possible.

The enrichment engine 206 can be configured to enrich the account accessinformation using extrinsic information. For example, the enrichmentengine 206 can enrich each record (or log line) included in the accountaccess information. Such enrichment can provide additional context forthe network-based address corresponding to the record.

In some embodiments, the enrichment engine 206 can enrich records (orlog lines) in the account access information to include respectivegeolocation information. For example, the enrichment engine 206 canevaluate corresponding network-based addresses for each record includedin the account access information. For each network-based address, theenrichment engine 206 can determine geolocation information thatidentifies a geographic region (or location) to which the network-basedaddress corresponds. Such geolocation information may be obtained usinggenerally known approaches including, for example, IP address databasesand/or IP geolocation services.

In some embodiments, the enrichment engine 206 can enrich each record(or log line) in the account access information to identify a respectiveInternet service provider (ISP) that assigned a network-based addressassociated with the record. For example, the enrichment engine 206 candetermine that an IP address 192.168.1.1 was assigned to a computingdevice by Internet Service Provider ABC. The enrichment engine 206 canthen associate the name of this ISP with the record corresponding to theIP address. In general, such ISP information may be obtained usingwell-known approaches.

In some embodiments, the enrichment engine 206 can enrich each record(or log line) in the account access information to include informationindicating whether a network-based address corresponding to the recordhas been whitelisted. For example, network-based addresses may bewhitelisted (or blacklisted) depending on geographic regions (orlocations) to which those network-based addresses correspond. In anotherexample, network-based addresses may be whitelisted (or blacklisted)depending on the type of data (or traffic) that is communicated fromcomputing devices assigned those network-based addresses. In someembodiments, only whitelisted network-based addresses are evaluated bythe correlation engine 208.

The correlation engine 208 can be configured to analyze the enrichedaccount access information. In some embodiments, the correlation engine208 can identify any network-based addresses used to access multipleaccounts through any of the various computing systems (or online serviceproviders). For example, the correlation engine 208 can determine that acomputing device assigned the IP address 192.168.0.31 accessed an emailaccount through a first online service provider, a bank account througha second online service provider, and a social networking accountthrough a third online service provider. In this example, the emailaccount provided by the first online service provider, the bank accountprovided by the second online service provider, and the socialnetworking account provided by the third online service provider can beassociated (or linked) with the IP address 192.168.0.31 that was used toaccess all three accounts. In some embodiments, accounts accessed fromthe same network-based address can be identified as being related and,optionally, may be flagged for further review.

In some embodiments, the correlation engine 208 can identify anynetwork-based addresses used to access multiple accounts through any ofthe various computing systems (or online service providers) within aspecified time period. For example, the correlation engine 208 candetermine that a computing device assigned the IP address 192.168.1.152accessed an email account through a first online service provider onJan. 29, 2017 and a bank account through a second online serviceprovider on Jan. 30, 2017. The correlation engine 208 can also determinethat a computing device assigned the IP address 192.168.0.11 accessed anemail account through the first online service provider on Jan. 30, 2017and a social networking account through the third online serviceprovider on Aug. 15, 2017. In this example, assuming the specified timeperiod corresponds to the month of January 2017, the correlation engine208 can identify the IP address 192.168.1.152 as a network-based addressthat was used to access multiple accounts (e.g., the email account andthe bank account) within the specified time period (e.g., January 2017).In contrast, the correlation engine 208 will not identify the IP address192.168.0.11 as a network-based address that was used to access multipleaccounts since this IP address only accessed one account (e.g., theemail account) within the specified time period.

In some embodiments, the correlation engine 208 can obtain and analyzeother types of information to identify accounts related to a givennetwork-based address. For example, in some embodiments, the correlationengine 208 can analyze financial reports that identify one or moreonline financial accounts and network-based addresses of computingdevices that were used to access those financial accounts. Thecorrelation engine 208 can match network-based addresses identified inthese financial reports with network-based addresses identified in theaccount access information described above. For example, the correlationengine 208 can determine that some computing device assigned the IPaddress 192.168.0.31 accessed an email account provided by a firstonline service provider, a bank account provided by a second onlineservice provider, and a social networking account provided by a thirdonline service provider based on the account access information. Thecorrelation engine 208 can also determine that the IP address192.168.0.31 was also used to access a financial account identified in afinancial report. In this example, the financial account identified infinancial report, the email account, the bank account, and the socialnetworking account can all be associated (or linked) with the IP address192.168.0.31. In some embodiments, the correlation engine 208 can outputinformation describing relationships between network-based addresses andaccounts associated with those network-based addresses in one or morereports, as illustrated in the example of FIG. 3 .

The export engine 210 can be configured to export information describingnetwork-based addresses and corresponding accounts identified as beingrelated to (or associated with) those network-based addresses. In someembodiments, such information can be exported to an external dataanalysis tool for further processing. For example, the data analysistool can be configured to supplement the exported information with datauncovered from separate investigations. In some embodiments, the dataanalysis tool can merge the exported information with correspondingobjects in an object graph. For example, the data analysis tool candetermine a network-based address that was used to access multipleaccounts from the exported information. The data analysis tool can alsodetermine an object in an object graph that corresponds to thenetwork-based address. In this example, the data analysis tool canassociate (or merge) any account information related to thenetwork-based address, as determined from the exported information, withthe object corresponding to the network-based address.

FIG. 3 illustrates a diagram of an example report 300. The examplereport 300 may be generated using the approaches described above, forexample. In some embodiments, the report 300 identifies network-basedaddresses 302, respective geolocation information 304 corresponding tothe network-based addresses, respective account information 306 foraccounts identified as being associated with the network-basedaddresses, and respective time periods 308 over which those accountswere accessed. Many variations are possible. In the example of FIG. 3 ,the report 300 identifies an IP address 192.168.1.1 that is associatedwith San Francisco, Calif. The report 300 also indicates that this IPaddress was used to access an email account, a bank account, and asocial networking account on Jan. 29, 2017.

FIG. 4 illustrates a flowchart of an example method 400, according tovarious embodiments of the present disclosure. The method 400 may beimplemented in various environments including, for example, theenvironment 100 of FIG. 1 . The operations of method 400 presented beloware intended to be illustrative. Depending on the implementation, theexample method 400 may include additional, fewer, or alternative stepsperformed in various orders or in parallel. The example method 400 maybe implemented in various computing systems or devices including one ormore processors.

At block 402, information from at least one computing system isobtained. The information can include a set of records that respectivelyidentify at least a network-based address of a computing device thataccessed the computing system and an account hosted by the computingsystem that was accessed using the computing device. At block 404, adetermination is made that at least a first account and a second accountwere accessed from one or more computing devices that share a givennetwork-based address based at least in part on the obtainedinformation. At block 406, an association is made between the firstaccount and the second account with the network-based address.

Hardware Implementation

The techniques described herein are implemented by one or morespecial-purpose computing devices. The special-purpose computing devicesmay be hard-wired to perform the techniques, or may include circuitry ordigital electronic devices such as one or more application-specificintegrated circuits (ASICs) or field programmable gate arrays (FPGAs)that are persistently programmed to perform the techniques, or mayinclude one or more hardware processors programmed to perform thetechniques pursuant to program instructions in firmware, memory, otherstorage, or a combination. Such special-purpose computing devices mayalso combine custom hard-wired logic, ASICs, or FPGAs with customprogramming to accomplish the techniques. The special-purpose computingdevices may be desktop computer systems, server computer systems,portable computer systems, handheld devices, networking devices or anyother device or combination of devices that incorporate hard-wiredand/or program logic to implement the techniques.

Computing device(s) are generally controlled and coordinated byoperating system software, such as iOS, Android, Chrome OS, Windows XP,Windows Vista, Windows 7, Windows 8, Windows Server, Windows CE, Unix,Linux, SunOS, Solaris, iOS, Blackberry OS, VxWorks, or other compatibleoperating systems. In other embodiments, the computing device may becontrolled by a proprietary operating system. Conventional operatingsystems control and schedule computer processes for execution, performmemory management, provide file system, networking, I/O services, andprovide a user interface functionality, such as a graphical userinterface (“GUI”), among other things.

FIG. 5 is a block diagram that illustrates a computer system 500 uponwhich any of the embodiments described herein may be implemented. Thecomputer system 500 includes a bus 502 or other communication mechanismfor communicating information, one or more hardware processors 504coupled with bus 502 for processing information. Hardware processor(s)504 may be, for example, one or more general purpose microprocessors.

The computer system 500 also includes a main memory 506, such as arandom access memory (RAM), cache and/or other dynamic storage devices,coupled to bus 502 for storing information and instructions to beexecuted by processor 504. Main memory 506 also may be used for storingtemporary variables or other intermediate information during executionof instructions to be executed by processor 504. Such instructions, whenstored in storage media accessible to processor 504, render computersystem 500 into a special-purpose machine that is customized to performthe operations specified in the instructions.

The computer system 500 further includes a read only memory (ROM) 508 orother static storage device coupled to bus 502 for storing staticinformation and instructions for processor 504. A storage device 510,such as a magnetic disk, optical disk, or USB thumb drive (Flash drive),etc., is provided and coupled to bus 502 for storing information andinstructions.

The computer system 500 may be coupled via bus 502 to a display 512,such as a cathode ray tube (CRT) or LCD display (or touch screen), fordisplaying information to a computer user. An input device 514,including alphanumeric and other keys, is coupled to bus 502 forcommunicating information and command selections to processor 504.Another type of user input device is cursor control 516, such as amouse, a trackball, or cursor direction keys for communicating directioninformation and command selections to processor 504 and for controllingcursor movement on display 512. This input device typically has twodegrees of freedom in two axes, a first axis (e.g., x) and a second axis(e.g., y), that allows the device to specify positions in a plane. Insome embodiments, the same direction information and command selectionsas cursor control may be implemented via receiving touches on a touchscreen without a cursor.

The computing system 500 may include a user interface module toimplement a GUI that may be stored in a mass storage device asexecutable software codes that are executed by the computing device(s).This and other modules may include, by way of example, components, suchas software components, object-oriented software components, classcomponents and task components, processes, functions, attributes,procedures, subroutines, segments of program code, drivers, firmware,microcode, circuitry, data, databases, data structures, tables, arrays,and variables.

In general, the word “module,” as used herein, refers to logic embodiedin hardware or firmware, or to a collection of software instructions,possibly having entry and exit points, written in a programminglanguage, such as, for example, Java, C or C++. A software module may becompiled and linked into an executable program, installed in a dynamiclink library, or may be written in an interpreted programming languagesuch as, for example, BASIC, Perl, or Python. It will be appreciatedthat software modules may be callable from other modules or fromthemselves, and/or may be invoked in response to detected events orinterrupts. Software modules configured for execution on computingdevices may be provided on a computer readable medium, such as a compactdisc, digital video disc, flash drive, magnetic disc, or any othertangible medium, or as a digital download (and may be originally storedin a compressed or installable format that requires installation,decompression or decryption prior to execution). Such software code maybe stored, partially or fully, on a memory device of the executingcomputing device, for execution by the computing device. Softwareinstructions may be embedded in firmware, such as an EPROM. It will befurther appreciated that hardware modules may be comprised of connectedlogic units, such as gates and flip-flops, and/or may be comprised ofprogrammable units, such as programmable gate arrays or processors. Themodules or computing device functionality described herein arepreferably implemented as software modules, but may be represented inhardware or firmware. Generally, the modules described herein refer tological modules that may be combined with other modules or divided intosub-modules despite their physical organization or storage.

The computer system 500 may implement the techniques described hereinusing customized hard-wired logic, one or more ASICs or FPGAs, firmwareand/or program logic which in combination with the computer systemcauses or programs computer system 500 to be a special-purpose machine.According to one embodiment, the techniques herein are performed bycomputer system 500 in response to processor(s) 504 executing one ormore sequences of one or more instructions contained in main memory 506.Such instructions may be read into main memory 506 from another storagemedium, such as storage device 510. Execution of the sequences ofinstructions contained in main memory 506 causes processor(s) 504 toperform the process steps described herein. In alternative embodiments,hard-wired circuitry may be used in place of or in combination withsoftware instructions.

The term “non-transitory media,” and similar terms, as used hereinrefers to any media that store data and/or instructions that cause amachine to operate in a specific fashion. Such non-transitory media maycomprise non-volatile media and/or volatile media. Non-volatile mediaincludes, for example, optical or magnetic disks, such as storage device510. Volatile media includes dynamic memory, such as main memory 506.Common forms of non-transitory media include, for example, a floppydisk, a flexible disk, hard disk, solid state drive, magnetic tape, orany other magnetic data storage medium, a CD-ROM, any other optical datastorage medium, any physical medium with patterns of holes, a RAM, aPROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip orcartridge, and networked versions of the same.

Non-transitory media is distinct from but may be used in conjunctionwith transmission media. Transmission media participates in transferringinformation between non-transitory media. For example, transmissionmedia includes coaxial cables, copper wire and fiber optics, includingthe wires that comprise bus 502. Transmission media can also take theform of acoustic or light waves, such as those generated duringradio-wave and infra-red data communications.

Various forms of media may be involved in carrying one or more sequencesof one or more instructions to processor 504 for execution. For example,the instructions may initially be carried on a magnetic disk or solidstate drive of a remote computer. The remote computer can load theinstructions into its dynamic memory and send the instructions over atelephone line using a modem. A modem local to computer system 500 canreceive the data on the telephone line and use an infra-red transmitterto convert the data to an infra-red signal. An infra-red detector canreceive the data carried in the infra-red signal and appropriatecircuitry can place the data on bus 502. Bus 502 carries the data tomain memory 506, from which processor 504 retrieves and executes theinstructions. The instructions received by main memory 506 may retrievesand executes the instructions. The instructions received by main memory506 may optionally be stored on storage device 510 either before orafter execution by processor 504.

The computer system 500 also includes a communication interface 518coupled to bus 502. Communication interface 518 provides a two-way datacommunication coupling to one or more network links that are connectedto one or more local networks. For example, communication interface 518may be an integrated services digital network (ISDN) card, cable modem,satellite modem, or a modem to provide a data communication connectionto a corresponding type of telephone line. As another example,communication interface 518 may be a local area network (LAN) card toprovide a data communication connection to a compatible LAN (or WANcomponent to communicated with a WAN). Wireless links may also beimplemented. In any such implementation, communication interface 518sends and receives electrical, electromagnetic or optical signals thatcarry digital data streams representing various types of information.

A network link typically provides data communication through one or morenetworks to other data devices. For example, a network link may providea connection through local network to a host computer or to dataequipment operated by an Internet Service Provider (ISP). The ISP inturn provides data communication services through the world wide packetdata communication network now commonly referred to as the “Internet”.Local network and Internet both use electrical, electromagnetic oroptical signals that carry digital data streams. The signals through thevarious networks and the signals on network link and throughcommunication interface 518, which carry the digital data to and fromcomputer system 500, are example forms of transmission media.

The computer system 500 can send messages and receive data, includingprogram code, through the network(s), network link and communicationinterface 518. In the Internet example, a server might transmit arequested code for an application program through the Internet, the ISP,the local network and the communication interface 518.

The received code may be executed by processor 504 as it is received,and/or stored in storage device 510, or other non-volatile storage forlater execution.

Each of the processes, methods, and algorithms described in thepreceding sections may be embodied in, and fully or partially automatedby, code modules executed by one or more computer systems or computerprocessors comprising computer hardware. The processes and algorithmsmay be implemented partially or wholly in application-specificcircuitry.

The various features and processes described above may be usedindependently of one another, or may be combined in various ways. Allpossible combinations and sub-combinations are intended to fall withinthe scope of this disclosure. In addition, certain method or processblocks may be omitted in some implementations. The methods and processesdescribed herein are also not limited to any particular sequence, andthe blocks or states relating thereto can be performed in othersequences that are appropriate. For example, described blocks or statesmay be performed in an order other than that specifically disclosed, ormultiple blocks or states may be combined in a single block or state.The example blocks or states may be performed in serial, in parallel, orin some other manner. Blocks or states may be added to or removed fromthe disclosed example embodiments. The example systems and componentsdescribed herein may be configured differently than described. Forexample, elements may be added to, removed from, or rearranged comparedto the disclosed example embodiments.

Conditional language, such as, among others, “can,” “could,” “might,” or“may,” unless specifically stated otherwise, or otherwise understoodwithin the context as used, is generally intended to convey that certainembodiments include, while other embodiments do not include, certainfeatures, elements and/or steps. Thus, such conditional language is notgenerally intended to imply that features, elements and/or steps are inany way required for one or more embodiments or that one or moreembodiments necessarily include logic for deciding, with or without userinput or prompting, whether these features, elements and/or steps areincluded or are to be performed in any particular embodiment.

Any process descriptions, elements, or blocks in the flow diagramsdescribed herein and/or depicted in the attached figures should beunderstood as potentially representing modules, segments, or portions ofcode which include one or more executable instructions for implementingspecific logical functions or steps in the process. Alternateimplementations are included within the scope of the embodimentsdescribed herein in which elements or functions may be deleted, executedout of order from that shown or discussed, including substantiallyconcurrently or in reverse order, depending on the functionalityinvolved, as would be understood by those skilled in the art.

It should be emphasized that many variations and modifications may bemade to the above-described embodiments, the elements of which are to beunderstood as being among other acceptable examples. All suchmodifications and variations are intended to be included herein withinthe scope of this disclosure. The foregoing description details certainembodiments of the invention. It will be appreciated, however, that nomatter how detailed the foregoing appears in text, the invention can bepracticed in many ways. As is also stated above, it should be noted thatthe use of particular terminology when describing certain features oraspects of the invention should not be taken to imply that theterminology is being re-defined herein to be restricted to including anyspecific characteristics of the features or aspects of the inventionwith which that terminology is associated. The scope of the inventionshould therefore be construed in accordance with the appended claims andany equivalents thereof.

Engines, Components, and Logic

Certain embodiments are described herein as including logic or a numberof components, engines, or mechanisms. Engines may constitute eithersoftware engines (e.g., code embodied on a machine-readable medium) orhardware engines. A “hardware engine” is a tangible unit capable ofperforming certain operations and may be configured or arranged in acertain physical manner. In various example embodiments, one or morecomputer systems (e.g., a standalone computer system, a client computersystem, or a server computer system) or one or more hardware engines ofa computer system (e.g., a processor or a group of processors) may beconfigured by software (e.g., an application or application portion) asa hardware engine that operates to perform certain operations asdescribed herein.

In some embodiments, a hardware engine may be implemented mechanically,electronically, or any suitable combination thereof. For example, ahardware engine may include dedicated circuitry or logic that ispermanently configured to perform certain operations. For example, ahardware engine may be a special-purpose processor, such as aField-Programmable Gate Array (FPGA) or an Application SpecificIntegrated Circuit (ASIC). A hardware engine may also includeprogrammable logic or circuitry that is temporarily configured bysoftware to perform certain operations. For example, a hardware enginemay include software executed by a general-purpose processor or otherprogrammable processor. Once configured by such software, hardwareengines become specific machines (or specific components of a machine)uniquely tailored to perform the configured functions and are no longergeneral-purpose processors. It will be appreciated that the decision toimplement a hardware engine mechanically, in dedicated and permanentlyconfigured circuitry, or in temporarily configured circuitry (e.g.,configured by software) may be driven by cost and time considerations.

Accordingly, the phrase “hardware engine” should be understood toencompass a tangible entity, be that an entity that is physicallyconstructed, permanently configured (e.g., hardwired), or temporarilyconfigured (e.g., programmed) to operate in a certain manner or toperform certain operations described herein. As used herein,“hardware-implemented engine” refers to a hardware engine. Consideringembodiments in which hardware engines are temporarily configured (e.g.,programmed), each of the hardware engines need not be configured orinstantiated at any one instance in time. For example, where a hardwareengine comprises a general-purpose processor configured by software tobecome a special-purpose processor, the general-purpose processor may beconfigured as respectively different special-purpose processors (e.g.,comprising different hardware engines) at different times. Softwareaccordingly configures a particular processor or processors, forexample, to constitute a particular hardware engine at one instance oftime and to constitute a different hardware engine at a differentinstance of time.

Hardware engines can provide information to, and receive informationfrom, other hardware engines. Accordingly, the described hardwareengines may be regarded as being communicatively coupled. Where multiplehardware engines exist contemporaneously, communications may be achievedthrough signal transmission (e.g., over appropriate circuits and buses)between or among two or more of the hardware engines. In embodiments inwhich multiple hardware engines are configured or instantiated atdifferent times, communications between such hardware engines may beachieved, for example, through the storage and retrieval of informationin memory structures to which the multiple hardware engines have access.For example, one hardware engine may perform an operation and store theoutput of that operation in a memory device to which it iscommunicatively coupled. A further hardware engine may then, at a latertime, access the memory device to retrieve and process the storedoutput. Hardware engines may also initiate communications with input oroutput devices, and can operate on a resource (e.g., a collection ofinformation).

The various operations of example methods described herein may beperformed, at least partially, by one or more processors that aretemporarily configured (e.g., by software) or permanently configured toperform the relevant operations. Whether temporarily or permanentlyconfigured, such processors may constitute processor-implemented enginesthat operate to perform one or more operations or functions describedherein. As used herein, “processor-implemented engine” refers to ahardware engine implemented using one or more processors.

Similarly, the methods described herein may be at least partiallyprocessor-implemented, with a particular processor or processors beingan example of hardware. For example, at least some of the operations ofa method may be performed by one or more processors orprocessor-implemented engines. Moreover, the one or more processors mayalso operate to support performance of the relevant operations in a“cloud computing” environment or as a “software as a service” (SaaS).For example, at least some of the operations may be performed by a groupof computers (as examples of machines including processors), with theseoperations being accessible via a network (e.g., the Internet) and viaone or more appropriate interfaces (e.g., an Application ProgramInterface (API)).

The performance of certain of the operations may be distributed amongthe processors, not only residing within a single machine, but deployedacross a number of machines. In some example embodiments, the processorsor processor-implemented engines may be located in a single geographiclocation (e.g., within a home environment, an office environment, or aserver farm). In other example embodiments, the processors orprocessor-implemented engines may be distributed across a number ofgeographic locations.

Language

Throughout this specification, plural instances may implementcomponents, operations, or structures described as a single instance.Although individual operations of one or more methods are illustratedand described as separate operations, one or more of the individualoperations may be performed concurrently, and nothing requires that theoperations be performed in the order illustrated. Structures andfunctionality presented as separate components in example configurationsmay be implemented as a combined structure or component. Similarly,structures and functionality presented as a single component may beimplemented as separate components. These and other variations,modifications, additions, and improvements fall within the scope of thesubject matter herein.

Although an overview of the subject matter has been described withreference to specific example embodiments, various modifications andchanges may be made to these embodiments without departing from thebroader scope of embodiments of the present disclosure. Such embodimentsof the subject matter may be referred to herein, individually orcollectively, by the term “invention” merely for convenience and withoutintending to voluntarily limit the scope of this application to anysingle disclosure or concept if more than one is, in fact, disclosed.

The embodiments illustrated herein are described in sufficient detail toenable those skilled in the art to practice the teachings disclosed.Other embodiments may be used and derived therefrom, such thatstructural and logical substitutions and changes may be made withoutdeparting from the scope of this disclosure. The Detailed Description,therefore, is not to be taken in a limiting sense, and the scope ofvarious embodiments is defined only by the appended claims, along withthe full range of equivalents to which such claims are entitled.

It will be appreciated that an “engine,” “system,” “data store,” and/or“database” may comprise software, hardware, firmware, and/or circuitry.In one example, one or more software programs comprising instructionscapable of being executable by a processor may perform one or more ofthe functions of the engines, data stores, databases, or systemsdescribed herein. In another example, circuitry may perform the same orsimilar functions. Alternative embodiments may comprise more, less, orfunctionally equivalent engines, systems, data stores, or databases, andstill be within the scope of present embodiments. For example, thefunctionality of the various systems, engines, data stores, and/ordatabases may be combined or divided differently.

“Open source” software is defined herein to be source code that allowsdistribution as source code as well as compiled form, with awell-publicized and indexed means of obtaining the source, optionallywith a license that allows modifications and derived works.

The data stores described herein may be any suitable structure (e.g., anactive database, a relational database, a self-referential database, atable, a matrix, an array, a flat file, a documented-oriented storagesystem, a non-relational No-SQL system, and the like), and may becloud-based or otherwise.

As used herein, the term “or” may be construed in either an inclusive orexclusive sense. Moreover, plural instances may be provided forresources, operations, or structures described herein as a singleinstance. Additionally, boundaries between various resources,operations, engines, engines, and data stores are somewhat arbitrary,and particular operations are illustrated in a context of specificillustrative configurations. Other allocations of functionality areenvisioned and may fall within a scope of various embodiments of thepresent disclosure. In general, structures and functionality presentedas separate resources in the example configurations may be implementedas a combined structure or resource. Similarly, structures andfunctionality presented as a single resource may be implemented asseparate resources. These and other variations, modifications,additions, and improvements fall within a scope of embodiments of thepresent disclosure as represented by the appended claims. Thespecification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense.

Conditional language, such as, among others, “can,” “could,” “might,” or“may,” unless specifically stated otherwise, or otherwise understoodwithin the context as used, is generally intended to convey that certainembodiments include, while other embodiments do not include, certainfeatures, elements and/or steps. Thus, such conditional language is notgenerally intended to imply that features, elements and/or steps are inany way required for one or more embodiments or that one or moreembodiments necessarily include logic for deciding, with or without userinput or prompting, whether these features, elements and/or steps areincluded or are to be performed in any particular embodiment.

Although the invention has been described in detail for the purpose ofillustration based on what is currently considered to be the mostpractical and preferred implementations, it is to be understood thatsuch detail is solely for that purpose and that the invention is notlimited to the disclosed implementations, but, on the contrary, isintended to cover modifications and equivalent arrangements that arewithin the spirit and scope of the appended claims. For example, it isto be understood that the present invention contemplates that, to theextent possible, one or more features of any embodiment can be combinedwith one or more features of any other embodiment.

The invention claimed is:
 1. A system comprising: one or moreprocessors; and memory storing instructions that, when executed by theone or more processors, cause the system to perform: obtaining log datafrom at least one computing system, the log data including a set ofrecords that identifies Internet Protocol (IP) addresses of computingdevices that accessed the at least one computing system and accountshosted by the at least one computing system that were accessed by thecomputing devices and timestamps indicating respective times of accessof the IP addresses; determining, based at least in part on the obtainedlog data, that at least a first account was accessed from a computingdevice of the computing devices with an IP address of the IP addresses,and a time at which the first account was accessed based on thetimestamps; enriching the set of records to indicate whether the IPaddress has been permitted based on geolocation log data correspondingto the IP address and based on a type of traffic from devices assignedto the IP address; in response to the IP address being permitted:ingesting a report specifying that a second account was accessed usingthe IP address; linking the second account and the first account withthe IP address; and flagging the linked first account and the secondaccount to be reviewed based on the respective times that the firstaccount and the second account were accessed.
 2. The system of claim 1,wherein the flagging further comprises: flagging the linked firstaccount, the second account, and the third account in response todetermining that the first account, the second account, and the thirdaccount were accessed by the computing device within a specifiedtimeframe.
 3. The system of claim 1, wherein the system furtherperforms: determining at least one record in the set of records thatcorresponds to a blocked IP address; and removing the at least onerecord from the set of records.
 4. The system of claim 1, wherein thesystem further performs: exporting data corresponding to the IP addressto a data analysis tool for further evaluation.
 5. The system of claim4, wherein the system further performs: determining at least one objectin an object model that corresponds to the IP address, the object modelbeing managed by the data analysis tool.
 6. The system of claim 1,wherein the system further performs: providing an interface throughwhich the link between the first account and the second account ispresented.
 7. The system of claim 1, wherein the enriching the set ofrecords further comprises incorporating other extrinsic information. 8.The system of claim 7, wherein the enriching the at least one recordcomprises: identifying a first record in the set of records; determiningthat the IP address associated with the first record is blocked; andassociating the first record with information that indicates the IPaddress is blocked.
 9. The system of claim 7, wherein enriching the atleast one record comprises: identifying a first record in the set ofrecords; determining geolocation log data associated with the IP addressassociated with the first record; and associating the geolocation logdata with the first record.
 10. The system of claim 1, wherein thesystem further performs: obtaining a set of financial reports from theat least one computing system, each financial report specifying one ormore IP addresses used to access one or more financial accounts; anddetermining at least a pair of financial accounts that were accessed bythe computing device with the IP address.
 11. A computer-implementedmethod, the method comprising: obtaining log data from at least onecomputing system, the log data including a set of records thatidentifies Internet Protocol (IP) addresses of computing devices thataccessed the at least one computing system and accounts hosted by the atleast one computing system that were accessed by the computing devicesand timestamps indicating respective times of access of the IPaddresses; determining, based at least in part on the obtained log data,that at least a first account was accessed from a computing device ofthe computing devices with an IP address of the IP addresses, and a timeat which the first account was accessed based on the timestamps;enriching the set of records to indicate whether the IP address has beenpermitted based on geolocation log data corresponding to the IP addressand based on a type of traffic from devices assigned to the IP address;in response to the IP address being permitted: ingesting a reportspecifying that a second account was accessed using the IP address;linking the second account and the first account with the IP address;and flagging the linked first account and the second account to bereviewed based on the respective times that the first account and thesecond account were accessed.
 12. The computer-implemented method ofclaim 11, wherein the flagging further comprises: flagging the linkedfirst account, the second account, and the third account in response todetermining that the first account, the second account, and the thirdaccount were accessed by the computing device within a specifiedtimeframe.
 13. The computer-implemented method of claim 11, furthercomprising: determining at least one record in the set of records thatcorresponds to a blocked IP address; and removing the at least onerecord from the set of records.
 14. The computer-implemented method ofclaim 11, further comprising: exporting data corresponding to the IPaddress to a data analysis tool for further evaluation.
 15. Thecomputer-implemented method of claim 14, wherein the system furtherperforms: determining at least one object in an object model thatcorresponds to the IP address, the object model being managed by thedata analysis tool.
 16. A non-transitory computer readable mediumcomprising instructions that, when executed, cause one or moreprocessors to perform: obtaining log data from at least one computingsystem, the log data including a set of records that identifies InternetProtocol (IP) addresses of computing devices that accessed the at leastone computing system and accounts hosted by the at least one computingsystem that were accessed by the computing devices and timestampsindicating respective times of access of the IP addresses; determining,based at least in part on the obtained log data, that at least a firstaccount was accessed from a computing device of the computing deviceswith an IP address of the IP addresses, and a time at which the firstaccount was accessed based on the timestamps; enriching the set ofrecords to indicate whether the IP address has been permitted based ongeolocation log data corresponding to the IP address and based on a typeof traffic from devices assigned to the IP address; in response to theIP address being permitted: ingesting a report specifying that a secondaccount was accessed using the IP address; linking the second accountand the first account with the IP address; and flagging the linked firstaccount and the second account to be reviewed based on the respectivetimes that the first account and the second account were accessed. 17.The non-transitory computer readable medium of claim 16, wherein theflagging further comprises: flagging the linked first account, thesecond account, and the third account in response to determining thatthe first account, the second account, and the third account wereaccessed by the computing device within a specified timeframe.
 18. Thenon-transitory computer readable medium of claim 16, wherein theinstructions, when executed, further cause the processors to perform:determining at least one record in the set of records that correspondsto a blocked IP address; and removing the at least one record from theset of records.
 19. The non-transitory computer readable medium of claim16, wherein the instructions, when executed, further cause theprocessors to perform: exporting data corresponding to the IP address toa data analysis tool for further evaluation.
 20. The non-transitorycomputer readable medium of claim 19, wherein the instructions, whenexecuted, further cause the processors to perform: creating the objectbased on an object graph, the object graph being created by the objectmodel and the object model being managed by the data analysis tool.